«

I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The server
I am using is Windows 2003 and I have set up 2 websites, one production and
one for test and development. This is our corporate intranet server and a
DNS entry is setup to point 'intranet' to this machine, however, the computer
name is different. Lets call it 'bob'. 'bob' has been trusted for
delegation.

If I go to http://bob.mydomain.net/mysite it works fine, both in test and
production. But if I go to http://intranet.mydomain.net/mysite I get "Login
failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

It seems pretty clear to me that the issue is the different DNS hostname,
but is there a work around for this?

You need to give the machine account an additional service principal name
(SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
does this. Your domain admin must run it.

That should allow the you to do Kerberos authentication with the different
DNS name. That should in turn allow delegation (assuming both sites use
Network Service as the app pool identity).

Joe K.

"Patrick Meehan" <> wrote in message
news:FD903F9F-D1BB-44D9-A462-...
>I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The
>server
> I am using is Windows 2003 and I have set up 2 websites, one production
> and
> one for test and development. This is our corporate intranet server and a
> DNS entry is setup to point 'intranet' to this machine, however, the
> computer
> name is different. Lets call it 'bob'. 'bob' has been trusted for
> delegation.
>
> If I go to http://bob.mydomain.net/mysite it works fine, both in test and
> production. But if I go to http://intranet.mydomain.net/mysite I get
> "Login
> failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
>
> It seems pretty clear to me that the issue is the different DNS hostname,
> but is there a work around for this?

Thanks, that worked perfectly. Any suggested reading to explain what it just
did?

"Joe Kaplan (MVP - ADSI)" wrote:

> You need to give the machine account an additional service principal name
> (SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
> does this. Your domain admin must run it.
>
> That should allow the you to do Kerberos authentication with the different
> DNS name. That should in turn allow delegation (assuming both sites use
> Network Service as the app pool identity).
>
> Joe K.
>
> "Patrick Meehan" <> wrote in message
> news:FD903F9F-D1BB-44D9-A462-...
> >I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The
> >server
> > I am using is Windows 2003 and I have set up 2 websites, one production
> > and
> > one for test and development. This is our corporate intranet server and a
> > DNS entry is setup to point 'intranet' to this machine, however, the
> > computer
> > name is different. Lets call it 'bob'. 'bob' has been trusted for
> > delegation.
> >
> > If I go to http://bob.mydomain.net/mysite it works fine, both in test and
> > production. But if I go to http://intranet.mydomain.net/mysite I get
> > "Login
> > failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
> >
> > It seems pretty clear to me that the issue is the different DNS hostname,
> > but is there a work around for this?
>
>
>

You absolutely can't go wrong with Keith Brown's book.

http://www.amazon.com/gp/product/032...957441-5804624

Also, there are some good troubleshooting docs that MS publishes:

http://www.microsoft.com/technet/pro.../tkerberr.mspx

If you are going to be using delegation, it pays to learn as much as you can
about it. My experience is that it is difficult to predict your results or
understand failures until you do (from someone who is just now getting to be
able to do both with moderate success).

Joe K.

"Patrick Meehan" <> wrote in message
news:06624310-6F41-460D-B818-...
> Thanks, that worked perfectly. Any suggested reading to explain what it
> just
> did?
>
> "Joe Kaplan (MVP - ADSI)" wrote:
>
>> You need to give the machine account an additional service principal name
>> (SPN) for http/bob.mydomain.com. There is a tool called setspn.exe that
>> does this. Your domain admin must run it.
>>
>> That should allow the you to do Kerberos authentication with the
>> different
>> DNS name. That should in turn allow delegation (assuming both sites use
>> Network Service as the app pool identity).
>>
>> Joe K.
>>
>> "Patrick Meehan" <> wrote in
>> message
>> news:FD903F9F-D1BB-44D9-A462-...
>> >I have developed a ASP.Net page with VS 2005 and SQL Server 2005. The
>> >server
>> > I am using is Windows 2003 and I have set up 2 websites, one production
>> > and
>> > one for test and development. This is our corporate intranet server
>> > and a
>> > DNS entry is setup to point 'intranet' to this machine, however, the
>> > computer
>> > name is different. Lets call it 'bob'. 'bob' has been trusted for
>> > delegation.
>> >
>> > If I go to http://bob.mydomain.net/mysite it works fine, both in test
>> > and
>> > production. But if I go to http://intranet.mydomain.net/mysite I get
>> > "Login
>> > failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
>> >
>> > It seems pretty clear to me that the issue is the different DNS
>> > hostname,
>> > but is there a work around for this?
>>
>>
>>